If I add SSO, does that allow anyone in our domain to use gtmhub?
When you add SSO, it enables anyone from your identity provider to log in to Gtmhub with their SSO credentials. However you have full control over that in your SSO. You can change the settings so only people you approve, or belong to a certain group can access the gtmhub application.
For example, if you're using G-suite SSO, you can find more info on how to grant or remove access to apps here.